SECURITY: Prevent external resources in SVG files

On bug 65724, it was discovered that a user could upload SVG images
with embedded <image> elements that pulled in the resource via http.
This could allow an attacker to track all viewers of an SVG by having
the image embed another image hosted on their own server.

While testing the patch, I also identified 3 more element namespaces
that have been used on commons and seem harmless, so I added those to
the whitelist.

Change-Id: Iaaabc3a60c0ec4e6e426a8680d7a2cef5d469d29

diff --git a/includes/upload/UploadBase.php b/includes/upload/UploadBase.php
index b8ca434..ac894ae 100644 (file)
--- a/includes/upload/UploadBase.php
+++ b/includes/upload/UploadBase.php
@@ -1390,12 +1390,19 @@ abstract class UploadBase {
                                return true;
                        }
 
-                       # href with javascript target
-                       if ( $stripped == 'href' && strpos( strtolower( $value ), 'javascript:' ) !== false ) {
-                               wfDebug( __METHOD__
-                                       . ": Found script in href attribute '$attrib'='$value' in uploaded file.\n" );
+                       # href with non-local target (don't allow http://, javascript:, etc)
+                       if ( $stripped == 'href'
+                               && strpos( $value, 'data:' ) !== 0
+                               && strpos( $value, '#' ) !== 0
+                       ) {
+                               if ( !( $strippedElement === 'a'
+                                       && preg_match( '!^https?://!im', $value ) )
+                               ) {
+                                       wfDebug( __METHOD__ . ": Found href attribute <$strippedElement "
+                                               . "'$attrib'='$value' in uploaded file.\n" );
 
-                               return true;
+                                       return true;
+                               }
                        }
 
                        # href with embedded svg as target